Class action lawsuit filed against CCC alleging consumer personal information misuse
A class action lawsuit filed Oct. 8 in California against CCC Intelligent Solutions and CCC Intelligent Solutions Holdings alleges that CCC stores personally identifiable information (PII) from collision repair estimates created in CCC ONE to inform its artificial intelligence products and analytics.
The PII in question includes customer names, home addresses, phone numbers, insurance claim numbers, vehicle identification numbers, license plate numbers, and vehicle mileage. CCC also stores photos of damaged vehicles, according to the suit.
Plaintiffs LaTrenda Zekenya Burries, Gloribel Lissbeth Garcia, and Katleen Saturné were all involved in vehicle collisions and sought repairs at California collision repair facilities.
The suit alleges intrusion upon seclusion, invasion of privacy under the California Constitution, unjust enrichment, and violation of California’s unfair competition law.
The Law Offices of Maro Burunsuzyan, on behalf of the plaintiffs, says the alleged harm is the loss of privacy and control over personal information, including the ability to decide whether it could be repurposed and commercially exploited, as well as being deprived of resulting economic value.
CCC allegedly combines stored PII with data across its network to build AI products and analytics that it licenses to other customers without notice, consent, or compensation to the consumers who own the information, according to the complaint.
When Repairer Driven News asked CCC for comment on the suit, CCC replied that it “doesn’t comment on pending litigation.”
The suit cites statements from CCC that it has “processed more than $2 trillion of historical data across our network” and has “developed more than 400 AI models.” It alleges that no version of CCC’s privacy policy in effect since April 2020 mentions AI or model training.
“Its contract with insurers provides that ‘CCC may use data to train AI Services,'” the complaint states. “Its contract with repair facilities reserves to CCC the use of the facility’s data for CCC’s own ‘product improvement, and research and development,’ a use that ‘may continue after the expiration or termination of this agreement.’ CCC tells consumers none of this. No page of the estimate describes CCC’s retention, aggregation, or commercial use of the personal information, or gives the consumer any way to opt out of it, see it, or delete it.”
The suit adds that a repair facility’s contract with CCC doesn’t equal consumers’ consent for CCC to collect and use their data.
“CCC’s own contract anticipates as much by requiring the repair facility to indemnify CCC ‘for failure to obtain the requisite authorizations,'” the suit states.
“In its current public privacy policy, CCC states that ‘[s]ome services help you communicate with third parties about your vehicle, including repair facilities and insurance companies. These repair facilities and insurance companies may provide us with information about you.’ …CCC’s own form agreements with the businesses that feed CCC ONE state, in CCC’s own words, what CCC may do with the personal information those businesses enter.”
The agreements noted in the suit are CCC’s Repair Facility License Agreement, effective in 2018; form Independent Appraiser Master License Agreement, reflected in a product schedule executed in 2024; the Insurer MSA, CCC’s public Master Services Agreement for insurers, last updated Nov. 7, 2025; and CCC’s companion Data Processing Addendum (DPA), last updated Nov. 4, 2025.
According to the suit, the Repair Facility License Agreement “authorizes CCC to provide the repair ‘content’ to insurers whose direct repair programs the shop participates in, or with whom the shop configures CCC ONE UpdatePlus to share information, and separately authorizes CCC to provide the Content to CCC’s vendor, Flash of Genius, Inc. (d/b/a UpdatePromise) (“Flash”), granting the identified insurers, CCC, and that vendor ‘perpetual, royalty-free licenses to use the content.'”
The agreement also “forbids the repair facility itself to ‘compile estimate data for the purpose of creating a database,’ a use that CCC reserves to itself…”
The Appraiser License Agreement also forbids the appraiser to “‘compile estimate data for the purpose of creating a database'” and “‘aggregate or co-mingle data in the programs and/or services or provide reports or analysis based on data in the programs and/or services to anyone.'”
It notes as well that a section of the Insurer MSA, titled “License by Customer to CCC,” “contemplates the development or testing of artificial intelligence tools or models on Customer Data that has not been de-identified, subject only to the customer’s prior written approval, which the provision states CCC may accept by e-mail from a vice-president-level or higher employee of the customer.”
The plaintiffs contend that consumers aren’t parties or signatories to the aforementioned agreements despite CCC’s collection, movement, and licensing of their personal information.
“The Repair Facility License Agreement runs between CCC and a collision repair facility, the Appraiser License Agreement runs between CCC and an independent appraiser, and the Insurer MSA and DPA run between CCC and an insurer,” the suit states.
“The only authorization CCC obtains to take and use consumers’ personal information under these agreements is the business’s own promise: under the Repair Facility License Agreement, customer ‘represents and warrants that it has full right and authority to provide the authorization and licenses contained herein,’ and indemnifies CCC ‘for failure to obtain the requisite authorizations;’ and under the Appraiser License Agreement, customer ‘represents and warrants that it has the right to provide the data to CCC.'”
The suit also states that CCC has patented training AI models on identifiable consumer data and harvesting vehicle event data recorder information, including U.S. Patent No. 10,922,726; U.S. Patent No. 11,727,551; and U.S. Patent No. 9,500,545.
“Taken together, these patents describe CCC’s designs for systems that ingest, store, retrain on, and reuse identifiable consumer and vehicle data of the kinds that populate CCC ONE, including names, home addresses, VINs, license plates, policy and claim identifiers, and event-data-recorder data,” the suit states. “On information and belief, CCC has implemented these designs in the CCC ONE platform and in the artificial-intelligence products and analytics it licenses to insurers and other customers.”
The proposed nationwide class includes more than 15 million U.S. vehicle owners or customers named on repair estimates that a U.S. collision repair facility prepared on CCC ONE in the four years before the complaint was filed. It also proposes a nationwide intrusion subclass and a California subclass.
Relief sought includes nominal and punitive damages, restitution and disgorgement of the value CCC obtained from consumers’ information, barring CCC from using consumer information for AI training or other purposes beyond the estimate without consent, and requiring CCC to delete consumer PII.
An injunction on behalf of the California subclass would require CCC to inform California consumers before or when their personal information is entered into CCC ONE at a collision repair facility of its identity, the categories of PII it collects, and the purposes of use for the PII. It would also require CCC to obtain consumer consent before using PII for any purpose beyond preparing or transmitting vehicle estimates or valuations.
CCC hadn’t filed a response to the suit in court as of Monday afternoon.
“Artificial intelligence is reshaping the economy, and the question of what these systems are built on has never mattered more,” said Maro Burunsuzyan, attorney for the plaintiffs and founder of the Law Offices of Maro Burunsuzyan, in a press release.
“The complaint alleges that, in CCC’s case, part of the answer is the personal information of ordinary people who simply needed a car repaired. Those drivers were never told, never asked, and never paid. This case is about restoring a basic principle: a company that wants to profit from your information should have to ask you first.”
Images
Featured image credit: Just_Super/iStock